A Credit Freeze Blocks the Rarer Kind of Identity Theft. Here Is What Blocks the Rest.

Disclosure: this article contains affiliate links, marked (paid link). If you buy through one we may earn a commission, at no extra cost to you. As an Amazon Associate I earn from qualifying purchases. It costs you nothing and it does not change what we recommend.

Every few months a letter arrives explaining that a company you may not remember dealing with has lost a file with your name in it, and offering you twelve months of free credit monitoring by way of apology. The Identity Theft Resource Center counted 3,322 data compromises in the United States in 2025 — a record, and a 79% increase over five years. In seven out of ten of those notices, the company did not say what actually happened.

The standard advice that follows is “freeze your credit.” It is good advice. It is free, it takes about twenty minutes, and almost nobody does it. But it is also advice given without the one piece of context that would let you judge it: a credit freeze only protects against one of the two things people mean when they say identity theft — and, by volume, it is the rarer one.

This article is about which half is which, what a freeze actually stops, what it demonstrably does not stop, and what covers the other half. Almost all of it costs nothing.

Two different crimes with one name

The most useful survey in this field is the U.S. Bureau of Justice Statistics’ Identity Theft Supplement to the National Crime Victimization Survey, because it asks a nationally representative sample what happened to them rather than counting complaints from people who chose to file one. Its most recent published wave found about 23.9 million people — 9% of Americans aged 16 and over — were identity theft victims in a single year.

Then it asked what kind. This is the number that should change what you do.

Most identity theft is somebody using an account you already have

For 76% of victims, the most recent incident involved the misuse of only one type of existing account — a credit card or a bank account.

Existing account misuse — a freeze does not stop thisEverything else, including new accounts opened in your name

76% — existing accounts

24%

Source: Bureau of Justice Statistics, Victims of Identity Theft, 2021 (Identity Theft Supplement to the National Crime Victimization Survey), published 2023.

That is the whole argument of this article in one bar. The freeze is worth doing — new-account fraud is the version that wrecks your credit file, takes months to unwind and can attach a car loan or a mortgage to your name. But if you freeze your credit and consider the problem handled, you have secured the door that roughly a quarter of the traffic uses.

What the current numbers look like

The Federal Trade Commission’s Consumer Sentinel Network collects reports rather than measuring prevalence, so its figures move with reporting behaviour as well as with crime. With that caveat, the direction has been unambiguous.

Reported fraud and identity theft, 2024 to 2025

These are reports filed with the FTC, not a measurement of how many people were affected. Most fraud is never reported at all.

$15.9bnreported losses to fraud in 2025, up about 24% on the $12.8bn reported in 2024

1.36midentity theft reports in 2025, up roughly 31% year on year

597,770credit card fraud reports in 2025 — hijacked cards and bogus new accounts — up 33%

$414median reported loss per fraud case, down from $498 the year before

3,322separate U.S. data compromises tracked in 2025, a record

Sources: Federal Trade Commission Consumer Sentinel Network data for 2024 and 2025, as compiled by Experian (July 2026); Identity Theft Resource Center, 2025 Annual Data Breach Report.

One line in the breach report deserves more attention than it gets. In 2025, 70% of breach notices contained no information about the attack — up from 65% in 2024 and 45% in 2023. The letters are getting less informative every year, which means the notice you receive is decreasingly capable of telling you whether you need to do anything. The reasonable response is to stop treating the letter as a trigger and set your defences once, permanently.

What a credit freeze actually is

A security freeze restricts access to your credit report. When a lender receives an application in your name, it pulls your file to decide whether to lend. If the file is frozen, it cannot, so it declines. That is the entire mechanism, and it is why it works: it does not detect fraud, it makes the fraud impossible to complete.

Since 21 September 2018, when the Economic Growth, Regulatory Relief and Consumer Protection Act took effect, freezes have been free at all three nationwide bureaus, for everyone, in every state. Before that, several states allowed the bureaus to charge for both placing and lifting one.

The blocking is narrower than most people assume

A freeze governs access to your credit file. It does not govern your money.

A freeze does stopNew credit accounts opened in your name. Credit cards, loans, car finance, mortgages, store credit and most mobile phone contracts — anything where a lender must check your file before saying yes.

A freeze does not stopAnything using accounts that already exist. Fraud on your current card, drained bank accounts, tax refund fraud, medical identity theft, someone taking over your email — or your existing creditors continuing to access your file.

Sources: Federal Trade Commission, “What to know about credit freezes and fraud alerts”; Consumer Financial Protection Bureau, Ask CFPB.

The most common objection is that a freeze will get in the way the next time you actually want credit. The law anticipated that, and the timelines are tighter than people expect.

How fast the bureaus are legally required to act

Under the Fair Credit Reporting Act as amended in 2018. All of it is free.

Action	Online or phone	By post
Place a freeze	Within 1 business day	Within 3 business days
Lift a freeze	Within 1 hour	Within 3 business days
Temporary lift for a set period	Within 1 hour	Within 3 business days
Written confirmation	Within 5 business days of placing	Within 5 business days of placing

Source: Consumer Financial Protection Bureau, “How do I put a freeze on my credit report?”; Fair Credit Reporting Act as amended by the Economic Growth, Regulatory Relief and Consumer Protection Act (2018).

Two practical notes that trip people up. First, you must freeze at all three bureaus separately — Equifax, Experian and TransUnion — because a lender needs only one unfrozen file to approve an application. Second, when you lift a freeze for a specific application, ask the lender which bureau they pull; you can then lift just that one, for just a few days.

Freeze, lock, or fraud alert

These three get used interchangeably in advertising and they are not the same thing at all. One of them is a statutory right; one of them is a product.

What each one is, and what it costs

The distinction that matters is whether your protection rests on a law or on a contract.

SECURITY FREEZEA right under federal law. Free, indefinite, and the bureaus are legally obliged to honour the timelines above. This is the one to use.

CREDIT LOCKA bureau’s own product, governed by its terms of service rather than by statute. Often faster and app-based; sometimes bundled with a paid subscription. Convenience, with weaker legal footing.

INITIAL FRAUD ALERTFree, lasts one year, renewable. Tells lenders to verify your identity before opening an account — but it is an instruction, not a block. Place it at one bureau and it must be passed to the others.

EXTENDED FRAUD ALERTLasts seven years. Requires an identity theft report — from the FTC or the police — so it is for people already victimised. Also removes you from prescreened credit offer lists.

Source: Federal Trade Commission, “What to know about credit freezes and fraud alerts,” consumer.ftc.gov.

Children deserve a separate sentence. A child’s credit file is unusually attractive to fraudsters because it is clean and nobody looks at it for eighteen years. Federal law lets a parent or guardian place a free freeze for a minor under 16, and the bureaus must create a file in order to freeze it. It is one of the few things on this list with no downside whatsoever.

The other 76%

If most identity theft is somebody using an account you already own, then most of your protection has to live at the account, not at the credit bureau. This part is less discussed because there is nothing to sell you.

Where each defence actually operates

Follow the path a criminal has to walk, and put the obstacle on it.

Proportions from Bureau of Justice Statistics, Victims of Identity Theft, 2021.

The account-level defences are boring and well established. Multi-factor authentication is the largest of them, and the kind of factor matters more than most people realise — we went through that evidence in our piece on phishing-resistant authentication. Transaction alerts on every card and account are the second: they turn a monthly discovery into a same-minute one.

There is also a social layer that no technical control touches. A fast-growing category of loss is not a stolen file at all — it is a person being talked into moving their own money, increasingly with a cloned voice. We covered that separately in AI voice cloning and family emergency scams.

What actually helps, in order

Ranked by how much of the problem each one removes

Everything in this list is free.

1. FREEZE ALL THREEEquifax, Experian, TransUnion, separately. Twenty minutes, once. Add a freeze for each child in the household while you are there.

2. TURN ON ALERTSEvery card, every bank account, thresholds as low as the app allows. This is the control that catches existing-account misuse, which is most of it.

3. MFA ON EMAIL FIRSTYour email address is the password-reset path for every other account you own. Secure it before the bank, not after.

4. STOP REUSING PASSWORDSCredential stuffing works because a password leaked from a forum in 2019 still opens a bank in 2026. A password manager makes this a solved problem.

5. READ THE STATEMENTSSmall test charges precede large ones. The two-dollar transaction you ignore is often somebody checking whether the card is live.

6. PULL YOUR REPORTSYou are entitled to free reports from all three bureaus through the official federal site. Stagger them, and read the account list rather than the score.

7. FILE PROPERLY IF IT HAPPENSAn FTC identity theft report is what unlocks the extended fraud alert, the seven-year protections and the right to have fraudulent entries blocked.

8. LOCK DOWN THE PHONEAdd a carrier PIN or port-out lock. SIM swapping defeats text-message codes, and the phone number is the recovery path for everything else.

Sources: Federal Trade Commission, IdentityTheft.gov; Consumer Financial Protection Bureau; Bureau of Justice Statistics, Victims of Identity Theft, 2021.

The few things worth buying (paid link)

Note how short this list is compared with the free one above. That is the point.

HARDWARE SECURITY KEYThe strongest available second factor for email and financial accounts, and the only one structurally resistant to phishing. Buy two — one to use, one in a drawer as backup.
Browse on Amazon →

CROSS-CUT SHREDDERUnglamorous and still relevant: stolen post and discarded statements remain a real route to account takeover, particularly for older adults.
Browse on Amazon →

LOCKING POST BOXOnly if your post is delivered somewhere anyone can reach it. Pre-approved credit offers and replacement cards arrive in the post.
Browse on Amazon →

What we are deliberately not linking: paid identity theft protection and credit monitoring subscriptions. They are the most heavily advertised product in this category and the least well matched to the problem. Monitoring is detection, not prevention — it tells you after your file has been pulled, whereas a freeze stops the pull. The free freeze covers the same new-account fraud those services watch for, and nothing in a subscription addresses the 76% of incidents involving accounts you already have. “Dark web scanning” is weaker still: finding your email address in a dump changes nothing about what you should do, because you should already have done it. If a service is offered free after a breach, taking it costs you nothing. Paying for one is buying an alarm for a door you can bolt shut for free.

Questions people ask

Will a freeze hurt my credit score?

No. A freeze restricts who can see your file; it does not change anything in it. Your score is calculated from the contents, which are unaffected. The CFPB states this directly, and it is the single most common reason people give for not freezing.

I am about to apply for a mortgage. Should I wait?

No — freeze now and lift when asked. A mortgage application typically pulls all three bureaus, so you would lift all three temporarily for the application window, which the bureaus must do within an hour of an online or telephone request. Ask your broker which bureaus they use and how long they need.

Does a freeze stop someone using my existing card?

No, and this is the misunderstanding worth carrying away from this article. Nobody checks your credit report to spend on a card that already exists. Existing-account misuse is stopped by alerts, by multi-factor authentication and by the card network’s own fraud controls — not by the bureaus.

I live outside the United States. Does any of this apply?

The mechanism generalises even though the statute does not. Most countries with a credit reporting industry have some equivalent — a notice of correction, a protective registration, a suppression request — and the split between new-account and existing-account fraud is a feature of how the crime works, not of American law. The account-level advice applies everywhere without modification.

Someone has already opened an account in my name. What now?

File an identity theft report with the FTC first, because that document is what unlocks your other rights: the extended seven-year fraud alert, the right to have fraudulent information blocked from your report, and the right to copies of the fraudulent application documents. Then freeze, then contact each affected creditor in writing. Keep every date and every reference number — the process is administrative, and it rewards records.

The short version

• 76% of identity theft involves an account you already have. A credit freeze does not touch that category.
• A freeze is free, indefinite and legally enforceable at all three bureaus since September 2018.
• Bureaus must place a freeze within one business day and lift it within one hour of an online or phone request.
• A freeze does not affect your credit score, and does not apply to employment, tenant or insurance screening.
• Freeze at all three bureaus. One unfrozen file is enough for a lender to approve an application.
• A fraud alert asks lenders to verify. A freeze prevents them proceeding. A credit lock is a product, not a right.
• Children under 16 can be frozen free. A clean, unwatched file is the most valuable kind.
• Alerts and MFA cover the three quarters a freeze misses. Email first, then money.
• Paid monitoring is detection sold as prevention. The free freeze does the preventing.

This article describes consumer protections and general security practice. It is not legal or financial advice, and I am not a lawyer or a financial adviser. Rules on credit files, fraud alerts and liability vary by country and change over time — check the current position with your own bureau, bank or regulator before relying on any of it.

On the links above: some are affiliate links, marked (paid link). If you buy through one we may earn a commission at no additional cost to you. As an Amazon Associate I earn from qualifying purchases. We link to product searches rather than specific items so that recommendations do not break as models change, and we say plainly when we are choosing not to link something. Full policy: Affiliate Disclosure.

Sources

• Bureau of Justice Statistics, U.S. Department of Justice. Victims of Identity Theft, 2021. Identity Theft Supplement to the National Crime Victimization Survey, published 2023. (23.9 million victims, 9% of persons aged 16 or older; 76% existing-account misuse; $16.4 billion in losses.)
• Federal Trade Commission. Consumer Sentinel Network Data Book 2024. (6.5 million consumer reports; $12.5 billion in reported fraud losses.)
• Federal Trade Commission Consumer Sentinel Network data for 2025, as compiled and reported by Experian, “Identity Theft Statistics,” updated July 2026. (1,358,253 identity theft reports; $15.86 billion in fraud losses; 597,770 credit card fraud reports; $414 median loss.)
• Identity Theft Resource Center. 2025 Annual Data Breach Report. (3,322 compromises; 278.8 million victim notices; 70% of notices without attack information; financial services the most breached sector.)
• Federal Trade Commission. “What to know about credit freezes and fraud alerts.” consumer.ftc.gov.
• Consumer Financial Protection Bureau. “How do I put a freeze on my credit report?” Ask CFPB.
• Federal Trade Commission. “Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts,” 21 September 2018.
• Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, amending the Fair Credit Reporting Act.